Safer Self-Hosting, Less Guesswork
Arivu now has a first-party installer for planning, installing, backing up, restoring, upgrading, and reconfiguring a self-hosted Go and SQLite instance.
Self-hosting should feel calm.
You should know what will change before an installer touches a server. You should know whether an existing proxy owns the host. You should be able to back up, restore, upgrade, and reconfigure without turning every maintenance task into a one-off shell session.
This update gives Arivu that guided operating path. The app still has the same small runtime shape: one Go application, embedded browser assets, and SQLite. What changed is the path around it.
Install With a Plan First
The new arivu-installer can show a plan before it applies changes. That matters on real servers, where Arivu may be sharing a VPS with another app, an existing Caddy site, Nginx, Apache, Docker, or a firewall that should not be changed casually.
The installer detects the host shape, chooses a safer proxy mode, and keeps shared-host behavior conservative. Clean hosts can use an Arivu-managed Caddy path. Existing-proxy hosts can bind Arivu on loopback and receive proxy snippets. App-only mode starts the service and leaves public routing to you.
What this means for you: You can self-host without guessing which files, ports, and proxy paths are about to change.
Day Two Work Gets Commands
The first install is only part of self-hosting. The quieter question is what happens later.
Arivu now has installer commands for status, backup, restore, upgrade, reconfigure, and uninstall. Backups use a SQLite-aware snapshot. Restores check local health before reporting success. Upgrades keep the previous binary available until the new service has passed health checks, then roll back if the replacement does not come up cleanly.
What this means for you: Backups, restores, and upgrades are no longer just instructions in a document. They are part of the operating surface.
Settings Move to the Right Place
The generated env file should stay small: service address, database path, public URL defaults, signup default, admin emails, secure-cookie default, and the secret key.
Routine changes belong in the app. Admin Settings can now manage public URL, signup policy, secure-cookie behavior, Gemini, Resend, and X settings at runtime. The UI shows where a value came from, and removing a database override falls back to the environment value.
What this means for you: You do not need to SSH in and restart the service just to update a provider key or change a routine app setting.
Other Quiet Hardening
This release also includes a batch of safety and reliability fixes that are intentionally less visible:
- Browser mutation protection is tighter.
- Outbound URL and X redirect validation fail closed in more cases.
- Import jobs recover stalled work more reliably and avoid inflated progress counts.
- Full JSON backups preserve more X bookmark metadata.
- App-only and firewall output now says what is actually complete, not what still needs an operator step.
None of these are flashy. That is the point. Self-hosted software earns trust by making the expected path boring and by refusing to pretend partial setup is finished.
Arivu is still a self-hosted second brain for saved web research, notes, research objects, Review, and cited answers. It is just easier to operate now.